All right, the business continuity plan.
Okay, business continuity plan is a
comprehensive document formulated to ensure resilience against potential
threats operations to continue under adverse or abnormal conditions.
Again, the goals, analyzing potential risks and losses, enabling risk management
process to lessen the prospect of a complete shutdown,
always prioritizing safety, health and welfare of the organization and staff.
Human life safety always our ultimate goal.
Minimizing infrastructural damage in the event of a disaster, restoring business
conditions to pre disaster levels, maintaining vital documents and telephone
numbers, employee details, vendor details, and so forth, providing staff training,
building awareness, and promoting disaster preparedness.
Training, really important.
In the training or testing phase of your
BCPDRP, you'll go through a variety of tabletops through full interruption test.
You don't have a mature business continuity disaster recovery plan until
you've completed a live failover within the recovery time objectives.
You practice, practice, practice until you got your recovery time objectives
complete, then you go into maintenance mode.
I mentioned earlier, business continuity plans are often outdated.
They get stale really quickly.
They should be linked to change management.
When changes occur in the environment, you want to update the business continuity and
disaster recovery plan accordingly because your environment is changing.
Also, any stakeholders, any participants in BCP or DMP activities, you need to
ensure that they've got a backup or depth in those positions and that the
responsibilities are transferred when the job is turned over and needs to be
included in job inscriptions to ensure that the replacement is also trained on
the disaster recovery planning and procedures.
So training, really important.
What looks good on paper almost never
works out in reality, needs to be refined or tweaked somehow.
The Disaster Recovery Plan.
Okay, its goals, reduce overall organizational risk,
alleviate concerns of senior management, ensure compliance with regulations,
provide a rapid response after a disruption.
There are some physical security
considerations that are tied into all this.
We talked about most of this in physical security, but things like fault tolerance
systems, uninterruptible power supplies, line conditioners, things like that.
Raid, we talked about that in backups.
Backups are definitely a huge
consideration with disaster recovery since you need to resume at the alternate site.
Also, the method at which you restore that
data can be periodic or interval based or real time.
You have things like electronic vaulting,
remote journaling, or live database updates.
Site to site backup, there you go, onsite or hot site.
I had to think about that for a second.
Bunk transfers, periodically, bulk transfers supplemented
with transaction logs or shadowing. That was the term I was looking for where an up
to date copy is always being maintained at the alternate site.
Again, everything needs to be tested.
Bcp and DRP are very closely intertwined.
It's an incredibly important part of
information security and it's also quite often overlooked or outdated.
Really important.
That is going to wrap up Module 21,
Deal with Business Conditioning Disaster Recovery.
We're going to continue the risk analysis discussion in the next module.